[ECR] [request]: Private authentication for Quay.io ECR Pull-Through Cache.

## Community Note

- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

---

## Tell us about your request

Support for adding authentication credentials to ECR pull-through cache configurations for **private Quay repositories**. This functionality already exists for Docker Hub and GitHub, but currently, Quay is only supported for public images.

---

## Which service(s) is this request for?

Amazon ECR

---

## Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

We want to use Amazon ECR pull-through cache to proxy images from private Quay repositories. This would reduce external dependencies, improve image pull latency and reliability, and centralize image access control.

Currently, ECR does not support credentials for Quay pull-through cache configurations, which makes it impossible to proxy private images. This is a blocker for organizations who rely on Quay as a secure image distribution source, especially in regulated or air-gapped environments.

Lack of this feature creates operational fragmentation—we must maintain sidecar proxy caches or replicate images manually, which introduces unnecessary toil, security risk, and inconsistency across environments.

---

## Are you currently working around this issue?

Yes. Workarounds include:
- Periodically syncing images from Quay to ECR via CI/CD pipelines
- Running self-managed pull-through caches (e.g., using Harbor or a reverse proxy with credentials)
- Granting broader-than-desired access to users or systems that must bypass ECR to pull from Quay directly

All of these approaches add maintenance overhead and reduce the benefits ECR already provides via its pull-through caching functionality.

---

## Additional context

- This feature is already implemented for authenticated Docker Hub and GitHub registry use cases
- Quay supports robot account tokens and OAuth-based access which could be integrated with this feature
- This is increasingly relevant as more orgs adopt Quay.io Enterprise or Red Hat Quay for image distribution
- Supporting this would allow ECR to act as a true edge cache across all major registries, simplifying multi-registry consumption in AWS environments

---

## Attachments

None at this time

The issue concerns Amazon ECR pull-through cache authentication for private Quay repositories and mentions existing authenticated Docker Hub and GitHub support, but it names no files, entry points, or tests. Start by locating those existing implementations and their tests; done means Quay credentials are supported and private images can be retrieved through ECR.

Written by the indexing model from the issue text.